I'm evaluating Splunk for our syslog needs. One of our final requirements is to have the ability to forward syslog messages to another system. Specifically, we need to forward messages based on the source host, severity level, or event code.
I've already checked out the article on sending a subset of data to a syslog server. In the example they show how you can apply forwarding to a host in props.conf. I'd like to know how I can do this based on field extractions. For instance, I'd like to forward all messages of a severity critical or greater to my other syslog server. I can do this by defining the REGEX in transforms.conf (see below for example), but this can get kind of sloppy. I already have the field extractions defined for the sourcetypes. I just don't know how to go about using them in this scenario.
props.conf
[source::udp:514]
TRANSFORMS-syslog_forwarder = send_to_syslog
transforms.conf
[send_to_syslog]
REGEX = %\w+-[012]-\w+
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group
outputs.conf
[syslog:my_syslog_group]
server = 192.168.100.100:514
... View more